Introduction
The Utila Co-Signer is a program that runs in your environment and signs transactions automatically. It works together with Utila's Secure Enclave, a separate, isolated environment that Utila hosts for you.
Your key share is one part of an MPC key. Utila never holds a complete private key, and neither your Co-Signer environment nor the Secure Enclave alone can sign a transaction. The Co-Signer keeps its key share encrypted at all times: it never appears in plain text in your Co-Signer environment, so malware on that host cannot extract it.
Why the Secure Enclave is trusted
The Secure Enclave runs on AWS Nitro Enclaves, a cloud security feature that creates isolated compute environments for processing sensitive data. This gives the Secure Enclave a Trusted Execution Environment (TEE): a space that is isolated and tamper resistant, so cryptographic operations happen only there.
Before the Co-Signer sends anything to the Secure Enclave, it checks an attestation confirming the enclave is genuine and running the expected software. Because key shares are processed only inside this isolated environment, and never exposed to the operating system, they stay protected from malware and key extraction attacks, even if the host itself is compromised.
Utila hosts the Secure Enclave for you, so there's no setup required on your side.
The automated signing process
Enrollment. When a Co-Signer device is enrolled, its key share is encrypted with the enclave key, during the key refresh process, and stored in encrypted form within your Co-Signer environment. Your environment never holds the share in plain text.
Signing request. When the Co-Signer needs to sign a transaction, it sends a signing request, along with the encrypted key share, to the Secure Enclave.
Decryption and signing. The Secure Enclave decrypts the key share and completes signing together with Utila, using the Utila MPC protocol. Neither side ever holds the complete private key.
Cleanup. The key share is not stored after signing. It is not written to disk, and it never appears in plaintext in your Co-Signer environment.